CVE-2026-13433 Overview
IBM i Access Client Solutions (ACS) versions 1.1.2.0 through 1.1.9.13 download product updates without verifying their integrity when configured to update from an IBM i host. An attacker positioned on the adjacent network can substitute the update payload with malicious code. The compromised code then executes on the ACS user's workstation with that user's privileges. The flaw is tracked under CWE-494: Download of Code Without Integrity Check.
Critical Impact
Adjacent-network attackers can deliver unverified update payloads that execute as trusted code on ACS workstations, resulting in full confidentiality, integrity, and availability compromise.
Affected Products
- IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13
- Workstations configured to receive ACS updates from an IBM i host
- Windows, macOS, and Linux endpoints running vulnerable ACS builds
Discovery Timeline
- 2026-08-12 - CVE-2026-13433 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-13433
Vulnerability Analysis
IBM i Access Client Solutions provides a Java-based workstation client for interacting with IBM i systems. ACS supports an auto-update mechanism that pulls new client code from an IBM i host over the network. In the affected releases, the client does not cryptographically verify the downloaded update artifacts before installing and executing them. An attacker who can influence the update channel can substitute arbitrary code, which ACS then trusts and runs.
The issue falls under [CWE-494]. Integrity checks such as signed manifests or code-signing verification on the update payload are either missing or insufficient to detect tampering.
Root Cause
The root cause is the absence of a trustworthy integrity check on update artifacts retrieved from the configured IBM i update source. Without signature validation, the client accepts any binary that the transport delivers as authentic ACS code.
Attack Vector
Exploitation requires adjacent-network access, meaning the attacker must reside on the same logical network segment as the workstation or the update source. Typical scenarios include ARP spoofing, rogue DHCP, DNS poisoning, or compromising an intermediate device on the path to the IBM i host. No user interaction and no prior authentication are required. Once the manipulated update is installed, the injected code runs in the context of the ACS user, enabling data theft, persistence, and lateral movement.
See the IBM Support Page for vendor-published technical details.
Detection Methods for CVE-2026-13433
Indicators of Compromise
- Unexpected modification timestamps or file hashes on ACS installation directories following an update cycle.
- ACS-launched child processes that deviate from the standard Java runtime behavior, such as spawned shells, script interpreters, or outbound C2 connections.
- Update traffic to ACS clients originating from hosts other than the sanctioned IBM i update server.
Detection Strategies
- Baseline known-good hashes for ACS binaries and compare after each update event to detect unauthorized changes.
- Monitor endpoint process trees for anomalous descendants of acslaunch_win-64.exe, acslaunch_win-32.exe, or the ACS Java process.
- Inspect network flows on segments hosting ACS clients for update sessions to unexpected IPs or unencrypted transports.
Monitoring Recommendations
- Enable network segmentation logging between workstation VLANs and IBM i hosts, and alert on ARP or DNS anomalies on those segments.
- Forward endpoint process, file, and network telemetry to a SIEM to correlate update events with subsequent process creation activity.
- Review IBM i audit journals for unexpected changes to the ACS distribution directory served to clients.
How to Mitigate CVE-2026-13433
Immediate Actions Required
- Upgrade IBM i Access Client Solutions to a fixed release as identified on the IBM Support Page.
- Restrict which IBM i hosts workstations are permitted to pull ACS updates from, and enforce this at the network layer.
- Audit currently deployed ACS versions across the fleet and prioritize systems running builds between 1.1.2.0 and 1.1.9.13.
Patch Information
IBM has published remediation guidance on the IBM Support Page. Administrators should apply the fixed ACS release referenced in that advisory to all workstations and update the source ACS distribution on IBM i hosts accordingly.
Workarounds
- Disable the ACS auto-update-from-IBM-i configuration and distribute updates through a controlled software deployment channel until patched.
- Require ACS update traffic to traverse only trusted, authenticated network paths, such as IPsec tunnels between the workstation subnet and the IBM i host.
- Remove ACS from workstations that do not require it to reduce the exposed attack surface.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
